An open-source AI coding agent that lives in your terminal.
This report presents the forensic synthetic code analysis of QwenLM/qwen-code, a TypeScript project with 26,008 GitHub stars. SynthScan v2.0 examined 2,314,095 lines of code across 6414 source files, recording 6307 pattern matches distributed across 23 syntactic categories. The overall adjusted score of 4.3 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 6307 distinct pattern matches across 23 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 27 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 29 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 173 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 175 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 200 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 202 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 222 | // ── Factory ────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 278 | // ── Lifecycle ──────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 366 | // ── Input ──────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 403 | // ── Wait ───────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 475 | // ── Capture ────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 641 | // ── Output access ──────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 697 | // ── Cleanup ────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 719 | // ── Internal: flush PTY → xterm.js ────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 753 | // ── Internal: resolve xterm.js path ───── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 767 | // ── Internal: build HTML ──────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/terminal-capture.ts | 876 | // ── Internal: utils ───────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/scenario-runner.ts | 17 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/scenario-runner.ts | 19 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/scenario-runner.ts | 89 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/terminal-capture/scenario-runner.ts | 91 | // ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …terminal-capture/skill-review-harness/text-capture.tsx | 300 | // ── BEFORE ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/cli/qwen-serve-client-mcp.test.ts | 666 | // ── The model→agent dispatch fired ────────────────────────────────────── | COMMENT |
| MEDIUM | integration-tests/cli/qwen-serve-client-mcp.test.ts | 678 | // ── SUCCESS PATH (session-scoped runtime MCP — #5626) ─────────────────── | COMMENT |
| MEDIUM | integration-tests/cli/qwen-serve-client-mcp.test.ts | 678 | // ── SUCCESS PATH (session-scoped runtime MCP — #5626) ─────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 90 | // ── 现有字段(保持不变) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 102 | // ── Phase 1 新增:来源与执行类型 ────────────────────────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 129 | // ── Phase 1 新增:模式能力 ────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 137 | // ── Phase 1 新增:可见性 ────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 151 | // ── Phase 3 预留:体验元数据(Phase 1 仅定义,不使用)────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 398 | // ── 现有方法(保持不变)──────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 403 | // ── Phase 1 新增方法 ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/design/slash-command/phase1-technical-design.md | 538 | // ───────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 2 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 20 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 40 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 42 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 249 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 251 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 268 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 270 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 313 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 315 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 360 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 362 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 386 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 388 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 416 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 418 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 455 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/test-rewind-e2e.sh | 457 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 14 | // ── Bearer tokens ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 36 | // ── QQBot tokens ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 44 | // ── Authorization header catch-all ──────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 58 | // ── DingTalk access token header ────────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 66 | // ── API key prefixes ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 121 | // ── AWS access key IDs ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 127 | // ── Key=value secret assignments ────────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 175 | // ── JSON-quoted secret fields ─────────────────────────────────── | COMMENT |
| MEDIUM | packages/acp-bridge/src/logRedaction.test.ts | 195 | // ── URL-embedded credentials ────────────────────────────────────── | COMMENT |
| 1355 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …kills/agent-reproduce-feature/scripts/capture_state.py | 186 | def replace_quoted_key_quoted_value(match: re.Match[str]) -> str: | CODE |
| LOW | integration-tests/test-helper.ts | 27 | export function createToolCallErrorMessage( | CODE |
| LOW | integration-tests/terminal-bench/qwen_code.py | 58 | def _install_agent_script_path(self) -> os.PathLike: | CODE |
| LOW | …-tests/terminal-capture/subagent-flicker-regression.ts | 173 | function buildSubagentSingleToolCall( | CODE |
| LOW | …-tests/terminal-capture/subagent-flicker-regression.ts | 232 | function startSubagentFakeOpenAIServer( | CODE |
| LOW | …terminal-capture/skill-review-harness/text-capture.tsx | 119 | async function findGlobalInteractiveChunk(chunksDir: string) { | CODE |
| LOW | …concurrent-runner/export-html-from-chatrecord-jsonl.js | 377 | function injectDataIntoHtmlTemplate(template, data) { | CODE |
| LOW | …concurrent-runner/export-html-from-chatrecord-jsonl.js | 488 | function computeStartTimeFromRecords(records) { | CODE |
| LOW | …concurrent-runner/export-html-from-chatrecord-jsonl.js | 500 | function extractToolNameFromRecord(record) { | CODE |
| LOW | …concurrent-runner/export-html-from-chatrecord-jsonl.js | 642 | function transformPartsToToolCallContent(parts) { | CODE |
| LOW | …concurrent-runner/export-html-from-chatrecord-jsonl.js | 706 | function convertChatRecordsToSessionData(records) { | CODE |
| LOW | …concurrent-runner/export-html-from-chatrecord-jsonl.js | 774 | function addOrMergeToolCallMessage(toolCallMessage) { | CODE |
| LOW | …concurrent-runner/export-html-from-chatrecord-jsonl.js | 913 | function buildSessionDataFromExportJsonl(objects) { | CODE |
| LOW | integration-tests/cli/_daemon-harness.ts | 257 | export function approveWorkspaceMcpServers( | CODE |
| LOW | integration-tests/cli/_daemon-benchmark-helpers.ts | 234 | export async function measureCliStartupWithProfiler(opts?: { | CODE |
| LOW | integration-tests/sdk-typescript/system-control.test.ts | 32 | function createStreamingInputWithControlPoint( | CODE |
| LOW | …ration-tests/sdk-typescript/permission-control.test.ts | 45 | function createStreamingInputWithControlPoint( | CODE |
| LOW | integration-tests/sdk-typescript/test-helper.ts | 720 | export function createControlledStreamingInput( | CODE |
| LOW | integration-tests/sdk-typescript/test-helper.ts | 836 | export function assertSuccessfulCompletion(messages: SDKMessage[]): void { | CODE |
| LOW | integration-tests/sdk-typescript/test-helper.ts | 975 | export function createToolCallErrorMessage( | CODE |
| LOW | docs/design/custom-api-key-auth-wizard-prd.md | 541 | function generateCustomApiKeyEnvKey(protocol: string, baseUrl: string): string { | CODE |
| LOW | docs/design/skill-required-capabilities.md | 143 | function skillMeetsRequiredCapabilities(skill: Skill, config: Config): boolean { | CODE |
| LOW | …s/design/2026-05-27-daemon-workspace-service-design.md | 208 | export function createDaemonWorkspaceService( | CODE |
| LOW | docs/design/f2-mcp-transport-pool.md | 852 | export function isWorkspaceScopedBudgetEvent( | CODE |
| LOW | docs/design/f2-mcp-transport-pool.md | 1218 | export function isWorkspaceScopedBudgetEvent( | CODE |
| LOW | docs/design/telemetry-resource-attributes-design.md | 218 | function parseOtelResourceAttributes( | CODE |
| LOW | docs/design/slash-command/phase1-technical-design.md | 336 | export function getEffectiveSupportedModes(cmd: SlashCommand): ExecutionMode[] { | CODE |
| LOW | docs/design/slash-command/phase1-technical-design.md | 448 | function filterCommandsForNonInteractive( | CODE |
| LOW | docs/design/slash-command/phase3-technical-design.md | 117 | export function getCommandSubcommandNames(cmd: SlashCommand): string[]; | CODE |
| LOW | …/design/prompt-cache/global-tool-schema-stable-sort.md | 192 | function compareToolsByDeclarationName( | CODE |
| LOW | docs/plans/2026-05-27-daemon-workspace-service.md | 973 | export function createDaemonWorkspaceService( | CODE |
| LOW | docs/plans/2026-05-26-daemon-logger.md | 1060 | export function createSpawnChannelFactory( | CODE |
| LOW | scripts/clean-package-build-artifacts.js | 32 | export function cleanPackageBuildArtifacts({ | CODE |
| LOW | scripts/verify-installation-release.js | 45 | function standaloneArchiveNamesFromReleaseTargets(releaseTargets) { | CODE |
| LOW | scripts/verify-installation-release.js | 181 | function assertExpectedChecksumEntries(checksums) { | CODE |
| LOW | scripts/verify-installation-release.js | 204 | async function assertRemoteAssetChecksums( | CODE |
| LOW | scripts/verify-installation-release.js | 289 | function assertNotRedirectResponse(response, displayUrl) { | CODE |
| LOW | scripts/build-standalone-release.js | 151 | function readClipboardPackageSpecs() { | CODE |
| LOW | scripts/daemon-dev.js | 68 | function serveArgsFromLauncherArgs() { | CODE |
| LOW | scripts/check-i18n.ts | 72 | export function shouldWriteUnusedKeysJson(): boolean { | CODE |
| LOW | scripts/check-i18n.ts | 162 | export function findForbiddenZhTwPatterns( | CODE |
| LOW | scripts/check-i18n.ts | 335 | function saveKeysOnlyInLocalesToJson( | CODE |
| LOW | scripts/workspaces.js | 13 | export function getWorkspacePackageJsonPaths(root, workspaces) { | CODE |
| LOW | scripts/desktop-openwork-sync.ts | 300 | async function ensureCommittedDesktopSource( | CODE |
| LOW | scripts/desktop-openwork-sync.ts | 456 | async function getMergeIntroducedCommits( | CODE |
| LOW | scripts/desktop-openwork-sync.ts | 512 | function targetAlreadySyncedCommit( | CODE |
| LOW | scripts/generate-settings-schema.ts | 50 | function convertItemDefinitionToJsonSchema( | CODE |
| LOW | scripts/generate-settings-schema.ts | 100 | function convertSettingToJsonSchema( | CODE |
| LOW | scripts/check-serve-fast-path-bundle.js | 129 | function findServePreListenRootOutputs(outputs) { | CODE |
| LOW | scripts/check-serve-fast-path-bundle.js | 201 | export function findServeFastPathBundleOffenders(metafile) { | CODE |
| LOW | scripts/check-serve-fast-path-bundle.js | 253 | export function formatServeFastPathBundleOffenders(offenders) { | CODE |
| LOW | scripts/get-release-version.js | 58 | function detectRollbackAndGetBaseline(npmDistTag) { | CODE |
| LOW | scripts/get-release-version.js | 223 | function getAndVerifyTags(npmDistTag, _gitTagPattern) { | CODE |
| LOW | scripts/get-release-version.js | 250 | function getLatestStableReleaseTag() { | CODE |
| LOW | scripts/prepare-package.js | 155 | function verifyNativeAudioCapturePackage(rootDir, distDir, { required } = {}) { | CODE |
| LOW | scripts/prepare-package.js | 331 | function assertNoSensitivePackageScanLiterals(distDir) { | CODE |
| LOW | scripts/prepare-package.js | 358 | function assertPreparedPackageSize(distDir, maxUnpackedBytes) { | CODE |
| LOW | scripts/prepare-package.js | 370 | function collectPreparedPackageFiles(distDir) { | CODE |
| LOW | scripts/build-hosted-installation-assets.js | 219 | async function buildHostedInstallationAssets(outDir, options = {}) { | CODE |
| LOW | scripts/build-hosted-installation-assets.js | 246 | function assertNoUnexpectedHostedFiles(outDir) { | CODE |
| 2436 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | esbuild.config.js | 121 | // collide with our injected bindings when code-splitting is enabled. | COMMENT |
| LOW | docs-site/next-env.d.ts | 1 | /// <reference types="next" /> | COMMENT |
| LOW | integration-tests/cli/qwen-serve-routes.test.ts | 121 | TOKEN, | COMMENT |
| LOW | integration-tests/cli/qwen-serve-routes.test.ts | 281 | expect(caps.v).toBe(1); | COMMENT |
| LOW | integration-tests/cli/qwen-serve-routes.test.ts | 541 | // Exactly one of the two reports `attached: false` (the spawn owner). | COMMENT |
| LOW | integration-tests/cli/qwen-serve-routes.test.ts | 561 | }); | COMMENT |
| LOW | integration-tests/cli/qwen-serve-baseline.test.ts | 441 | ); | COMMENT |
| LOW | integration-tests/cli/qwen-serve-baseline.test.ts | 461 | // workspace budget controller's reserved count — 0 when budgets | COMMENT |
| LOW | integration-tests/cli/qwen-serve-client-mcp.test.ts | 81 | // `mcp__<server>__<tool>` name (see `DiscoveredMCPTool`), and a tool call must | COMMENT |
| LOW | integration-tests/cli/qwen-serve-client-mcp.test.ts | 401 | ws.close(); | COMMENT |
| LOW | integration-tests/cli/qwen-serve-streaming.test.ts | 41 | // Match the rest of the integration suite: prefer `TEST_CLI_PATH` | COMMENT |
| LOW | integration-tests/cli/qwen-serve-streaming.test.ts | 381 | expect([voteA.status, voteB.status].sort()).toEqual([200, 404]); | COMMENT |
| LOW | integration-tests/cli/acp-integration.test.ts | 101 | // Use --acp by default, but allow testing with --experimental-acp for backward compatibility | COMMENT |
| LOW | docs/design/telemetry-subagent-spans-design.md | 321 | COMMENT | |
| LOW | docs/plans/2026-05-26-daemon-logger.md | 1061 | options: SpawnChannelFactoryOptions = {}, | COMMENT |
| LOW | docs/users/qwen-serve.md | 601 | > identifier; new setups should use a currently supported auth provider. | COMMENT |
| LOW | docs/developers/examples/daemon-client-quickstart.md | 41 | // read back the daemon's primary workspace. | COMMENT |
| LOW | scripts/build_package.js | 1 | /** | COMMENT |
| LOW | scripts/sandbox_command.js | 1 | /** | COMMENT |
| LOW | scripts/start.js | 1 | /** | COMMENT |
| LOW | scripts/esbuild-shims.js | 21 | import { dirname } from 'node:path'; | COMMENT |
| LOW | scripts/build.js | 1 | /** | COMMENT |
| LOW | scripts/build.js | 41 | // 1. core (foundation package, includes test-utils) | COMMENT |
| LOW | scripts/test-rewind-e2e.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/clean.js | 1 | /** | COMMENT |
| LOW | scripts/generate-git-commit-info.js | 1 | /** | COMMENT |
| LOW | scripts/build_vscode_companion.js | 1 | /** | COMMENT |
| LOW | scripts/build_sandbox.js | 1 | /** | COMMENT |
| LOW | scripts/copy_files.js | 1 | #!/usr/bin/env node | COMMENT |
| LOW | scripts/sign-release.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/copy_bundle_assets.js | 1 | /** | COMMENT |
| LOW | scripts/build-hosted-installation-assets.js | 141 | }; | COMMENT |
| LOW | packages/acp-bridge/src/workspacePaths.ts | 41 | */ | COMMENT |
| LOW | packages/acp-bridge/src/bridgeClient.test.ts | 241 | const client = makeClient({ writeText: vi.fn(), readText }); | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 321 | * `httpAcpBridge.ts` are defense-in-depth, not load-bearing, and | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 401 | }; | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 421 | // `warned` flag clears only after `WARN_RESET_RATIO` hysteresis | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 541 | if (opts.lastEventId !== undefined) { | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 561 | // that called this "TERMINAL" — that's misleading for oncall; | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 641 | // The ring only ever contains live events (publish() always | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 661 | // has no positive signal that replay drained — they have to | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.ts | 701 | // never iterates again — without this the entry would linger in | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.test.ts | 721 | ).toHaveLength(1); | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.test.ts | 761 | const bus = new EventBus(); | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.test.ts | 801 | const abort = new AbortController(); | COMMENT |
| LOW | packages/acp-bridge/src/eventBus.test.ts | 981 | // Must `await` the iteration: the prior `void (async () => …)()` form | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 3281 | }); | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 3721 | // from the moment `channelFactory(boundWorkspace)` returns, but | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 3801 | const bridge = makeBridge({ | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 3821 | // sat AFTER initialize, so any number of yields here would still | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 3841 | void spawnPromise; | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 3881 | // The second session is on the fresh channel (handles[1]), not | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 6181 | await bridge.shutdown(); | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 6681 | }); | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 6801 | outcome: { outcome: string }; | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 7701 | } finally { | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 10061 | // Exactly one event got through. Codex review fix #1 changed | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 10161 | expect(collected[0]?.type).toBe('mcp_budget_warning'); | COMMENT |
| LOW | packages/acp-bridge/src/bridge.test.ts | 10261 | COMMENT | |
| LOW | packages/acp-bridge/src/bridge.test.ts | 11881 | // = A` would (1) skip `A.sessionIds.delete()` because | COMMENT |
| 1424 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .qwen/skills/desktop-pet/SKILL.md | 20 | ## Step 1: Identify the Character | COMMENT |
| LOW | .qwen/skills/desktop-pet/SKILL.md | 34 | ## Step 2: Design the Color Palette | COMMENT |
| LOW | .qwen/skills/desktop-pet/SKILL.md | 50 | ## Step 3: Generate the Spritesheet | COMMENT |
| LOW | .qwen/skills/desktop-pet/SKILL.md | 77 | ## Step 4: Create `pet.json` | COMMENT |
| LOW | .qwen/skills/desktop-pet/SKILL.md | 95 | ## Step 5: Verify and Activate | COMMENT |
| LOW | .qwen/skills/memory-leak-debug/SKILL.md | 20 | ## Step 1: Start the CLI with Snapshot Signal | COMMENT |
| LOW | .qwen/skills/memory-leak-debug/SKILL.md | 62 | ## Step 2: Exercise the Suspected Leak | COMMENT |
| LOW | .qwen/skills/memory-leak-debug/SKILL.md | 78 | ## Step 3: Start chrome-devtools Daemon | COMMENT |
| LOW | .qwen/skills/memory-leak-debug/SKILL.md | 87 | ## Step 4: Identify the Leak | COMMENT |
| LOW | .qwen/skills/memory-leak-debug/SKILL.md | 126 | ## Step 5: Identify Root Cause | COMMENT |
| LOW | .qwen/skills/memory-leak-debug/SKILL.md | 141 | ## Step 6: Verify Fix | COMMENT |
| LOW | .qwen/skills/bugfix/SKILL.md | 24 | ## Step 1: Read The Issue | COMMENT |
| LOW⚡ | .qwen/skills/bugfix/SKILL.md | 49 | ## Step 2: Reproduce | COMMENT |
| LOW⚡ | .qwen/skills/bugfix/SKILL.md | 58 | ## Step 3: Fix | COMMENT |
| LOW⚡ | .qwen/skills/bugfix/SKILL.md | 67 | ## Step 4: Verify | COMMENT |
| LOW | .qwen/skills/bugfix/SKILL.md | 82 | ## Step 5: Tests | COMMENT |
| LOW | .qwen/skills/bugfix/SKILL.md | 88 | ## Step 6: Self-Audit and Code Review | COMMENT |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 904 | # Step 1: Create worktree | COMMENT |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 911 | # Step 2: Run CLI | COMMENT |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 916 | # Step 3: Success | COMMENT |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 953 | # Step 5: Collect session log (before cleanup) | COMMENT |
| LOW | integration-tests/concurrent-runner/runner.py | 937 | # Step 4: Capture git diff (before cleanup) | COMMENT |
| LOW | integration-tests/concurrent-runner/runner.py | 976 | # Step 7: Cleanup | COMMENT |
| LOW | …tion-tests/interactive/file-system-interactive.test.ts | 45 | // Step 1: Read the file | COMMENT |
| LOW | …tion-tests/interactive/file-system-interactive.test.ts | 59 | // Step 2: Write the file | COMMENT |
| LOW | docs/design/custom-api-key-auth-wizard-prd.md | 201 | ### Step 1: Select Protocol | COMMENT |
| LOW | docs/design/custom-api-key-auth-wizard-prd.md | 227 | ### Step 2: Enter Base URL | COMMENT |
| LOW | docs/design/custom-api-key-auth-wizard-prd.md | 298 | ### Step 3: Enter API Key | COMMENT |
| LOW | docs/design/custom-api-key-auth-wizard-prd.md | 325 | ### Step 4: Enter Model IDs | COMMENT |
| LOW | docs/design/custom-api-key-auth-wizard-prd.md | 366 | ### Step 5: Review JSON | COMMENT |
| LOW | docs/design/custom-api-key-auth-wizard-prd.md | 447 | ### Step 6: Save and Authenticate | COMMENT |
| LOW | docs/plans/2026-05-28-computer-use-built-in.md | 1783 | // Step 1: install approval gate. | COMMENT |
| LOW | docs/plans/2026-05-28-computer-use-built-in.md | 1799 | // Step 2: spawn (idempotent). | COMMENT |
| LOW | docs/plans/2026-05-28-computer-use-built-in.md | 1805 | // Step 3: macOS permission probe + guide. | COMMENT |
| LOW | docs/e2e-tests/worktree-phase-c.md | 484 | # Step 1: enter worktree | COMMENT |
| LOW | docs/e2e-tests/worktree-phase-c.md | 490 | # Step 2: read the absolute worktree path so the model knows where to write | COMMENT |
| LOW | docs/e2e-tests/worktree-phase-c.md | 501 | # Step 3: Exit with keep via the tool | COMMENT |
| LOW | docs/e2e-tests/worktree-phase-c.md | 507 | # Step 4: Verify worktree still on disk after exit | COMMENT |
| LOW | docs/users/quickstart.md | 15 | ## Step 1: Install Qwen Code | COMMENT |
| LOW | docs/users/quickstart.md | 55 | ## Step 2: Set up authentication | COMMENT |
| LOW | docs/users/quickstart.md | 88 | ## Step 3: Start your first session | COMMENT |
| LOW | docs/users/configuration/auth.md | 167 | #### Step 1: Configure models and providers in `~/.qwen/settings.json` | COMMENT |
| LOW | docs/users/configuration/auth.md | 226 | #### Step 2: Set environment variables | COMMENT |
| LOW | docs/users/configuration/auth.md | 292 | #### Step 3: Switch models with `/model` | COMMENT |
| LOW | docs/users/extension/getting-started-extensions.md | 9 | ## Step 1: Create a New Extension | COMMENT |
| LOW | docs/users/extension/getting-started-extensions.md | 29 | ## Step 2: Understand the Extension Files | COMMENT |
| LOW | docs/users/extension/getting-started-extensions.md | 112 | ## Step 3: Build and Link Your Extension | COMMENT |
| LOW | docs/users/extension/getting-started-extensions.md | 141 | ## Step 4: Add a Custom Command | COMMENT |
| LOW | docs/users/extension/getting-started-extensions.md | 170 | ## Step 5: Add Custom Skills and Subagents (Optional) | COMMENT |
| LOW | docs/users/extension/getting-started-extensions.md | 251 | ## Step 6: Add a Custom `QWEN.md` | COMMENT |
| LOW | docs/users/extension/getting-started-extensions.md | 282 | ## Step 7: Releasing Your Extension | COMMENT |
| LOW | …er/rust/crates/cua-driver/tests/protocol_media_test.rs | 191 | // Step 1: click with from_zoom=true and NO prior zoom context — expect error. | COMMENT |
| LOW | …er/rust/crates/cua-driver/tests/protocol_media_test.rs | 202 | // Step 2: call zoom on that window to store context. | COMMENT |
| LOW | …er/rust/crates/cua-driver/tests/protocol_media_test.rs | 219 | // Step 3: click with from_zoom=true — should NOT return the "no zoom context" error. | COMMENT |
| LOW⚡ | …driver/rust/crates/platform-windows/src/tools/impl_.rs | 2443 | // Step 2: pin overlay to target window, then animate to screen coords. | COMMENT |
| LOW⚡ | …driver/rust/crates/platform-windows/src/tools/impl_.rs | 2446 | // Step 3: click pulse + actual click. | COMMENT |
| LOW⚡ | …river/rust/crates/platform-macos/src/input/skylight.rs | 375 | // Step 3: defocus previous front. | COMMENT |
| LOW⚡ | …river/rust/crates/platform-macos/src/input/skylight.rs | 381 | // Step 4: focus target. | COMMENT |
| LOW⚡ | …a-driver/rust/crates/platform-macos/src/input/mouse.rs | 242 | // Step 1: mouseMoved at target (phase=2, clickState=0). | COMMENT |
| LOW⚡ | …a-driver/rust/crates/platform-macos/src/input/mouse.rs | 250 | // Step 2: off-screen primer click — opens Chromium user-activation gate | COMMENT |
| 146 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/cua-driver/rust/crates/cua-driver/Cargo.toml | 76 | # Shared integration-test harness (MCP/CLI transports, child reaping, paths, | COMMENT |
| MEDIUM | …river/rust/crates/cua-driver/tests/harness_wpf_test.rs | 588 | // coords, so it's the more robust slider integration test. | COMMENT |
| MEDIUM | …/cua-driver/tests/modality_desktop_scope_linux_test.rs | 18 | //! #[ignore] (needs an X11/Xwayland display + AT-SPI + the GTK3 harness). Run: | COMMENT |
| MEDIUM | …/cua-driver/tests/modality_desktop_scope_linux_test.rs | 80 | /// carries that aid and has a frame, so we're robust to the exact field name. | COMMENT |
| MEDIUM | packages/cua-driver/rust/crates/cua-driver/src/serve.rs | 859 | /// (EV cert per #1602) so Windows AIS would elevate it to UIAccess integrity at | COMMENT |
| MEDIUM | …-driver/rust/crates/platform-linux/src/atspi/native.rs | 1006 | /// Vision/pixel click that actually lands — the Wayland answer (and a robust | COMMENT |
| MEDIUM | …driver/rust/crates/platform-windows/src/tools/impl_.rs | 3950 | // the string. Documented gap-closer (PR #1699 harness exposed). | COMMENT |
| MEDIUM | …ust/crates/platform-windows/src/tools/page_bookmark.rs | 146 | /// is robust against re-renders that change the title mid-flight. | COMMENT |
| MEDIUM | …a-driver/rust/crates/platform-macos/src/tools/click.rs | 177 | // screenshot width / logical screen width. This is robust even when | COMMENT |
| LOW | packages/cua-driver/scripts/_install-local-rust.sh | 384 | # every rebuild regardless, so resetting it would just add friction. | COMMENT |
| MEDIUM | packages/cua-driver/scripts/_install-common.sh | 118 | # user's `qwen-cua-driver-foo` test harness or any script | COMMENT |
| MEDIUM | packages/cua-driver/scripts/_install-common.sh | 177 | # robust to a missing trailing newline. | COMMENT |
| MEDIUM | packages/cua-driver/test-harness/smoke/macos.sh | 4 | # Spawns the built AppKit harness app from libs/cua-driver/rust/test-apps/harness-appkit | COMMENT |
| MEDIUM | packages/cua-driver/test-harness/smoke/macos.sh | 5 | # (source lives under libs/cua-driver/test-harness/apps/macos), | COMMENT |
| MEDIUM | packages/cua-driver/test-harness/smoke/macos.sh | 17 | # - libs/cua-driver/test-harness/build/macos.sh must have been run | COMMENT |
| MEDIUM⚡ | packages/cua-driver/test-harness/smoke/macos.sh | 94 | # Resolve harness window via list_windows (so window_id is the real one). | COMMENT |
| MEDIUM | packages/cua-driver/test-harness/smoke/macos.sh | 156 | # Coordinate-based clicks against the harness window's known scenarios. | COMMENT |
| MEDIUM | …driver/test-harness/linux-container/modality_matrix.sh | 13 | # Paths derive from $HOME so the same harness drives both container lanes: | COMMENT |
| MEDIUM | …ckages/cua-driver/test-harness/linux-container/calc.sh | 2 | # cua-driver modality test harness for the XFCE-in-a-container lane. | COMMENT |
| MEDIUM | …kages/cua-driver/test-harness/linux-container/derec.sh | 2 | # cua-driver desktop modality + recording harness — the SSH/VM lane. | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/macos/mac-rec.py | 20 | # window-local POINTS (measured live against the rebuilt parity harness, window 700x1112). | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/macos/mac-rec.py | 27 | # window-local POINTS (measured live against the rebuilt parity harness, window 700x820). | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/macos/mac-rec.py | 51 | HX, HY = 0, 40 # harness top-left | CODE |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/macos/mac-rec.py | 165 | # ---------- harness state reader (parse AX tree_markdown) ---------- | COMMENT |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/macos/mac-rec.py | 170 | # web harness exposes plain-text status labels (counter=N, mirror=..., etc.) | COMMENT |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/macos/mac-rec.py | 178 | # NATIVE (appkit/swiftui): rebuilt parity harness exposes the SAME web-style status | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/macos/mac-rec.py | 252 | # launch harness | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/macos/mac-rec.py | 275 | # make harness visible (recording carve-out) + position LEFT | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/macos/mac-rec.py | 410 | # Web harness (WKWebView / Electron). AX mode dispatches by element_index — AXPress works on | COMMENT |
| MEDIUM | …/test-harness/modality-recordings/linux/lin-harness.py | 4 | # accessible name. The harness also (a) exports each named widget's screen rect | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 2 | # Linux modality recorder for the ELECTRON harness — parity with the Windows | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 8 | # - launches the Electron app (Chromium) instead of lin-harness.py | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 9 | # - resolves the harness window by substring "CuaTestHarness Electron" (cdp-suffixed title) | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 10 | # - reads BOTH control geometry AND harness state from the web-AX tree | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 147 | # position windows: harness LEFT, dashboard RIGHT + above | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 155 | # GENUINE foreground baseline before each action: a real, ACTIVATED, non-harness window. | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 158 | # action click-activates the target, the harness silently stays the active window and every later | COMMENT |
| MEDIUM⚡ | …-harness/modality-recordings/linux/lin-rec-electron.py | 160 | # so it stays invisible in the recording but remains a valid activatable non-harness foreground | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-rec-electron.py | 77 | # ---------- per-action EFFECT verifier: read the web harness's own status labels via web-AX ---------- | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-rec-electron.py | 180 | # so each action is measured against a true non-harness foreground baseline. Then re-assert the | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-rec-electron.py | 191 | # resolve harness window | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-rec-electron.py | 314 | # anchor ONTO the harness; "held" is the anchor staying active. (fg modes keep the harness in | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-rec-electron.py | 322 | # measure: steal = active window moved OFF the anchor baseline onto the harness after the action. | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-rec-electron.py | 99 | return "na" # press-key (Tab): no observable harness-state effect | CODE |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/linux/lin-rec.py | 74 | # did the action actually change the harness's state? | COMMENT |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/linux/lin-rec.py | 123 | # position windows: harness LEFT, dashboard RIGHT + above | COMMENT |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/linux/lin-rec.py | 131 | # GENUINE foreground baseline before each action: a real, ACTIVATED, non-harness window. | COMMENT |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/linux/lin-rec.py | 134 | # action click-activates the target, the harness silently stays the active window and every later | COMMENT |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/linux/lin-rec.py | 136 | # so it stays invisible in the recording but remains a valid activatable non-harness foreground | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/linux/lin-rec.py | 4 | # Produces one single-modality recording: GTK3 harness LEFT, WebKit dashboard RIGHT | COMMENT |
| MEDIUM⚡ | …iver/test-harness/modality-recordings/linux/lin-rec.py | 82 | return "na" # press-key (Tab): no observable harness-state effect to assert | CODE |
| MEDIUM | …iver/test-harness/modality-recordings/linux/lin-rec.py | 156 | # so each action is measured against a true non-harness foreground baseline. Then re-assert the | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/linux/lin-rec.py | 167 | # resolve harness window | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/linux/lin-rec.py | 269 | # anchor ONTO the harness; "held" is the anchor staying active. (fg modes keep the harness in | COMMENT |
| MEDIUM | …iver/test-harness/modality-recordings/linux/lin-rec.py | 277 | # measure: steal = active window moved OFF the anchor baseline onto the harness after the action. | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-all-electron.sh | 2 | # Run all 5 modality recordings against the Electron harness, save re-encoded | COMMENT |
| MEDIUM | …-harness/modality-recordings/linux/lin-run-electron.sh | 3 | # launches lin-rec-electron.py (which spawns the Electron harness itself). | COMMENT |
| MEDIUM⚡ | …er/test-harness/vision-agent-test/vision_agent_test.py | 219 | # WKWebView harness click-target, WINDOW scope. Web <span> consumes | COMMENT |
| MEDIUM | …er/test-harness/vision-agent-test/vision_agent_test.py | 231 | # AppKit harness click-target, WINDOW scope. NSButton. Coordinate maps | COMMENT |
| MEDIUM | …er/test-harness/vision-agent-test/vision_agent_test.py | 245 | # WKWebView harness click-target, DESKTOP scope — THE 2x RETINA PATH, the | COMMENT |
| 24 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 904 | # Step 1: Create worktree | COMMENT |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 911 | # Step 2: Run CLI | COMMENT |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 916 | # Step 3: Success | COMMENT |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 953 | # Step 5: Collect session log (before cleanup) | COMMENT |
| LOW | integration-tests/concurrent-runner/runner.py | 937 | # Step 4: Capture git diff (before cleanup) | COMMENT |
| LOW | integration-tests/concurrent-runner/runner.py | 976 | # Step 7: Cleanup | COMMENT |
| LOW | …tion-tests/interactive/file-system-interactive.test.ts | 45 | // Step 1: Read the file | COMMENT |
| LOW | …tion-tests/interactive/file-system-interactive.test.ts | 59 | // Step 2: Write the file | COMMENT |
| LOW | …er/rust/crates/cua-driver/tests/protocol_media_test.rs | 191 | // Step 1: click with from_zoom=true and NO prior zoom context — expect error. | COMMENT |
| LOW | …er/rust/crates/cua-driver/tests/protocol_media_test.rs | 202 | // Step 2: call zoom on that window to store context. | COMMENT |
| LOW | …er/rust/crates/cua-driver/tests/protocol_media_test.rs | 219 | // Step 3: click with from_zoom=true — should NOT return the "no zoom context" error. | COMMENT |
| LOW⚡ | …driver/rust/crates/platform-windows/src/tools/impl_.rs | 2443 | // Step 2: pin overlay to target window, then animate to screen coords. | COMMENT |
| LOW⚡ | …driver/rust/crates/platform-windows/src/tools/impl_.rs | 2446 | // Step 3: click pulse + actual click. | COMMENT |
| LOW⚡ | …river/rust/crates/platform-macos/src/input/skylight.rs | 375 | // Step 3: defocus previous front. | COMMENT |
| LOW⚡ | …river/rust/crates/platform-macos/src/input/skylight.rs | 381 | // Step 4: focus target. | COMMENT |
| LOW⚡ | …a-driver/rust/crates/platform-macos/src/input/mouse.rs | 242 | // Step 1: mouseMoved at target (phase=2, clickState=0). | COMMENT |
| LOW⚡ | …a-driver/rust/crates/platform-macos/src/input/mouse.rs | 250 | // Step 2: off-screen primer click — opens Chromium user-activation gate | COMMENT |
| LOW | …a-driver/rust/crates/platform-macos/src/input/mouse.rs | 267 | // Step 3: target click pair(s) with clickState stepped 1→N for double-click | COMMENT |
| LOW⚡ | …es/cua-driver/rust/tests/integration/v2/test_safari.py | 252 | # Step 1: click the text input first to put focus inside Safari's web content | COMMENT |
| LOW⚡ | …es/cua-driver/rust/tests/integration/v2/test_safari.py | 258 | # Step 2: click the textarea | COMMENT |
| LOW⚡ | …es/cua-driver/rust/tests/integration/v2/test_safari.py | 264 | # Step 3: type — keystrokes go to the focused element | COMMENT |
| LOW⚡ | …er/test-harness/vision-agent-test/vision_agent_test.py | 115 | # Step 1: CAPTURE | COMMENT |
| LOW⚡ | …er/test-harness/vision-agent-test/vision_agent_test.py | 147 | # Step 2: LOCATE — pluggable. Contract: (image, expected_dims) -> pixel. | COMMENT |
| LOW⚡ | …er/test-harness/vision-agent-test/vision_agent_test.py | 177 | # Step 3: ACT | COMMENT |
| LOW⚡ | …er/test-harness/vision-agent-test/vision_agent_test.py | 194 | # Step 4: VERIFY — pluggable oracle. Reads the TARGET's own resulting state. | COMMENT |
| LOW | packages/core/src/tools/computer-use/bootstrap.ts | 236 | // Step 1: install approval gate (gates the download). | COMMENT |
| LOW⚡ | packages/core/src/tools/computer-use/bootstrap.ts | 258 | // Step 2: ensure the binary is present (download on first use; no-op after). | COMMENT |
| LOW⚡ | packages/core/src/tools/computer-use/bootstrap.ts | 261 | // Step 3: macOS permission flow (one permission at a time; see file header). | COMMENT |
| LOW⚡ | packages/core/src/tools/computer-use/bootstrap.ts | 266 | // Step 4: spawn the proxy against the now-granted daemon. | COMMENT |
| LOW | packages/core/src/core/geminiChat.test.ts | 2281 | // Step 1: auto-compression fails — counter increments on the chat. | COMMENT |
| LOW | packages/core/src/core/geminiChat.test.ts | 2306 | // Step 2: a forced /compress succeeds. After this, the counter must | COMMENT |
| LOW | packages/core/src/core/geminiChat.test.ts | 2325 | // Step 3: next auto-compression sees the reset counter. | COMMENT |
| LOW | packages/core/src/core/geminiChat.test.ts | 3780 | // Step 1: latch the breaker via MAX_CONSECUTIVE_FAILURES below-hard | COMMENT |
| LOW | packages/core/src/core/geminiChat.test.ts | 3812 | // Step 2: bump lastPromptTokenCount into hard tier and send again. | COMMENT |
| LOW | packages/core/src/core/geminiChat.test.ts | 3844 | // Step 3: verify the post-call reset took effect on the chat. A | COMMENT |
| LOW | packages/core/src/core/geminiChat.ts | 1747 | // Step 1: force microcompaction (clear old tool results + media) | COMMENT |
| LOW | packages/core/src/core/geminiChat.ts | 1760 | // Step 2: strip thinking parts from model turns | COMMENT |
| LOW⚡ | …core/src/core/openaiContentGenerator/converter.test.ts | 5237 | // Step 1: Simulate what transformMcpContentToParts returns for a Figma | COMMENT |
| LOW⚡ | …core/src/core/openaiContentGenerator/converter.test.ts | 5246 | // Step 2: convertToFunctionResponse wraps the MCP result | COMMENT |
| LOW⚡ | …core/src/core/openaiContentGenerator/converter.test.ts | 5255 | // Step 3: Build the conversation history (model tool call + tool result) | COMMENT |
| LOW | …core/src/core/openaiContentGenerator/converter.test.ts | 5275 | // Step 4: Convert to OpenAI format | COMMENT |
| LOW⚡ | packages/core/src/extension/marketplace.ts | 416 | // Step 1: Parse source into repo and optional pluginName | COMMENT |
| LOW⚡ | packages/core/src/extension/marketplace.ts | 423 | // Step 2: Determine repo type with correct priority order | COMMENT |
| LOW | packages/core/src/extension/marketplace.ts | 500 | // Step 3: If marketplace config exists, update type to marketplace | COMMENT |
| LOW⚡ | packages/core/src/extension/gemini-converter.ts | 87 | // Step 1: Copy all files and directories to temporary directory | COMMENT |
| LOW⚡ | packages/core/src/extension/gemini-converter.ts | 90 | // Step 2: Convert TOML commands to Markdown in commands folder | COMMENT |
| LOW⚡ | packages/core/src/extension/gemini-converter.ts | 96 | // Step 3: Create qwen-extension.json with converted config | COMMENT |
| LOW⚡ | packages/core/src/extension/claude-converter.ts | 458 | // Step 1: Load marketplace.json | COMMENT |
| LOW | packages/core/src/extension/claude-converter.ts | 489 | // Step 2: Resolve plugin source directory based on source field | COMMENT |
| LOW | packages/core/src/extension/claude-converter.ts | 508 | // Step 3: Load and merge plugin.json if exists (based on strict mode) | COMMENT |
| LOW | packages/core/src/models/modelsConfig.test.ts | 435 | // Step 1: Switch to a provider model - this applies provider config | COMMENT |
| LOW | packages/core/src/models/modelsConfig.test.ts | 455 | // Step 2: User manually sets credentials via updateCredentials | COMMENT |
| LOW | packages/core/src/models/modelsConfig.ts | 992 | // Step 1: If modelId exists in registry, always use config from modelRegistry | COMMENT |
| LOW | packages/core/src/models/modelsConfig.ts | 1078 | // Step 2: Check if there are existing credentials from other sources (not modelProviders) | COMMENT |
| LOW⚡ | packages/core/src/models/modelsConfig.ts | 1117 | // Step 3: Fall back to default model for the authType | COMMENT |
| LOW⚡ | packages/core/src/models/modelsConfig.ts | 1127 | // Step 4: No default available - leave generationConfig incomplete | COMMENT |
| LOW⚡ | packages/core/src/services/usageHistoryService.test.ts | 609 | // Step 1: open /stats (first time) during the live session. | COMMENT |
| LOW⚡ | packages/core/src/services/usageHistoryService.test.ts | 612 | // Step 2: /clear or exit. | COMMENT |
| LOW⚡ | packages/core/src/services/usageHistoryService.test.ts | 621 | // Step 3: re-open /stats. | COMMENT |
| LOW⚡ | packages/desktop/scripts/build-server.ts | 821 | // Step 1: Clean | COMMENT |
| 80 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .qwen/skills/desktop-pet/scripts/gen_spritesheet.py | 244 | except Exception: | CODE |
| LOW | …wen/skills/agent-reproduce-feature/scripts/llm_dump.py | 142 | except Exception as exc: | CODE |
| MEDIUM | integration-tests/concurrent-runner/runner.py | 1065 | print(f"Error: Config file not found: {args.config}", file=sys.stderr) | CODE |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 926 | except Exception as e: | CODE |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 950 | except Exception as e: | CODE |
| LOW⚡ | integration-tests/concurrent-runner/runner.py | 963 | except Exception as e: | CODE |
| LOW | integration-tests/concurrent-runner/runner.py | 246 | except Exception: | CODE |
| LOW | integration-tests/concurrent-runner/runner.py | 346 | except Exception as e: | CODE |
| LOW | integration-tests/concurrent-runner/runner.py | 1077 | except Exception as e: | CODE |
| MEDIUM | docs/users/features/hooks.md | 1307 | print(f"Error: Invalid JSON input: {e}", file=sys.stderr) | CODE |
| MEDIUM | docs/developers/sdk-python.md | 65 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | docs/developers/sdk-python.md | 111 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | docs/developers/sdk-python.md | 268 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | docs/developers/sdk-python.md | 328 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | docs/developers/sdk-python.md | 369 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | docs/developers/sdk-python.md | 401 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | docs/developers/sdk-python.md | 429 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | docs/developers/sdk-python.md | 462 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 59 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 103 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 201 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 272 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 350 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 382 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 410 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| MEDIUM | packages/sdk-python/README.md | 442 | print(f"Error: {error.get('message', 'Unknown error')}") | CODE |
| LOW | packages/sdk-python/scripts/smoke_real.py | 365 | except Exception as exc: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/query.py | 123 | except Exception as exc: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/query.py | 141 | except Exception as exc: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/query.py | 165 | except Exception as exc: # pragma: no cover - critical propagation path | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/query.py | 217 | except Exception as exc: # pragma: no cover - fatal background path | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/query.py | 254 | except Exception as exc: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/query.py | 299 | except Exception as exc: | CODE |
| LOW⚡ | packages/sdk-python/src/qwen_code_sdk/query.py | 470 | except Exception as exc: | CODE |
| MEDIUM | packages/sdk-python/src/qwen_code_sdk/query.py | 113 | def _initialize(self) -> None: | CODE |
| MEDIUM | packages/sdk-python/src/qwen_code_sdk/query.py | 126 | def _send_single_turn_prompt(self) -> None: | CODE |
| MEDIUM | packages/sdk-python/src/qwen_code_sdk/query.py | 150 | def _message_router(self) -> None: | CODE |
| MEDIUM | packages/sdk-python/src/qwen_code_sdk/query.py | 212 | def runner() -> None: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/transport.py | 105 | except Exception: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 53 | except Exception: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 75 | except Exception as exc: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 164 | except Exception: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 174 | except Exception: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 186 | except Exception: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 207 | except Exception: | CODE |
| LOW | packages/cua-driver/python/build_wheel.py | 128 | except Exception as e: | CODE |
| LOW | packages/cua-driver/python/build_wheel.py | 160 | except Exception as e: | CODE |
| LOW | packages/cua-driver/python/src/cua_driver/wrapper.py | 69 | except Exception as e: | CODE |
| MEDIUM | packages/cua-driver/python/src/cua_driver/wrapper.py | 70 | print(f"Error executing cua-driver: {e}", file=sys.stderr) | CODE |
| LOW | packages/cua-driver/wayland-helper/install.sh | 17 | except Exception: l = [] | CODE |
| LOW | …cua-driver/rust/crates/platform-linux/src/atspi/mod.rs | 178 | except Exception as e: | CODE |
| LOW | …river/rust/tests/integration/test_cursor_visibility.py | 249 | except Exception: | CODE |
| LOW | …river/rust/tests/integration/test_cursor_visibility.py | 269 | except Exception as e: | CODE |
| LOW | …river/rust/tests/integration/test_cursor_visibility.py | 341 | except Exception: | CODE |
| LOW | …river/rust/tests/integration/test_cursor_visibility.py | 364 | except Exception as e: | CODE |
| LOW | …iver/rust/tests/integration/test_focus_steal_parity.py | 95 | except Exception: | CODE |
| LOW | …ges/cua-driver/rust/tests/integration/driver_client.py | 55 | except Exception: | CODE |
| LOW | …ges/cua-driver/rust/tests/integration/driver_client.py | 60 | except Exception: | CODE |
| LOW | …ges/cua-driver/rust/tests/integration/driver_client.py | 77 | except Exception: | CODE |
| LOW | …iver/rust/tests/integration/test_concurrent_drivers.py | 212 | except Exception as e: | CODE |
| 103 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …/openaiContentGenerator/openaiContentGenerator.test.ts | 175 | generatorWithClient.pipeline.client.embeddings.create.mockRejectedValue( | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 323 | expect(instance.containerView.setBounds.mock.calls.at(-1)?.[0]).toEqual({ | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 329 | expect(instance.containerView.setBorderRadius.mock.calls.at(-1)?.[0]).toBe(0) | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 330 | expect(instance.toolbarView.setBorderRadius.mock.calls.at(-1)?.[0]).toBe(0) | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 331 | expect(instance.pageView.setBorderRadius.mock.calls.at(-1)?.[0]).toBe(0) | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 332 | expect(instance.nativeOverlayView.setBorderRadius.mock.calls.at(-1)?.[0]).toBe(0) | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 333 | expect(instance.pageView.setBackgroundColor.mock.calls.at(-1)?.[0]).toBe('#00000000') | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 336 | expect(instance.toolbarView.setBounds.mock.calls.at(-1)?.[0]).toEqual({ | CODE |
| CRITICAL⚡ | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 342 | expect(instance.pageView.setBounds.mock.calls.at(-1)?.[0]).toEqual({ | CODE |
| CRITICAL | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 356 | expect(instance.containerView.setBounds.mock.calls.at(-1)?.[0]).toEqual({ | CODE |
| CRITICAL | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 415 | instance.pageView.webContents.loadURL.mock.calls.filter( | CODE |
| CRITICAL | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 814 | const sendCallsAfterShow = instance.window.webContents.send.mock.calls.slice(sendsBeforeShow) | CODE |
| CRITICAL | …ectron/src/main/__tests__/browser-pane-manager.test.ts | 847 | const sendCallsAfterFinishLoad = instance.window.webContents.send.mock.calls.slice(sendsBeforeFinishLoad) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .qwen/skills/desktop-pet/scripts/gen_spritesheet.py | 16 | CODE | |
| LOW | …kills/agent-reproduce-feature/scripts/capture_state.py | 4 | CODE | |
| LOW | …wen/skills/agent-reproduce-feature/scripts/llm_dump.py | 7 | CODE | |
| LOW | …skills/agent-reproduce-align/scripts/compare_traces.py | 4 | CODE | |
| LOW | …kills/agent-reproduce-align/scripts/normalize_trace.py | 4 | CODE | |
| LOW | integration-tests/concurrent-runner/runner.py | 9 | CODE | |
| LOW | integration-tests/concurrent-runner/runner.py | 20 | CODE | |
| LOW | integration-tests/concurrent-runner/runner.py | 30 | CODE | |
| LOW | integration-tests/concurrent-runner/runner.py | 30 | CODE | |
| LOW | packages/sdk-python/tests/unit/test_validation.py | 1 | CODE | |
| LOW | packages/sdk-python/tests/unit/test_transport.py | 1 | CODE | |
| LOW | packages/sdk-python/tests/unit/test_query_core.py | 1 | CODE | |
| LOW | packages/sdk-python/tests/integration/conftest.py | 1 | CODE | |
| LOW | …ckages/sdk-python/tests/integration/test_sync_query.py | 1 | CODE | |
| LOW | …kages/sdk-python/tests/integration/test_async_query.py | 1 | CODE | |
| LOW | packages/sdk-python/scripts/smoke_real.py | 8 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/query.py | 3 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/transport.py | 3 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 3 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 8 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 8 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 8 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 8 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 8 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 15 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 39 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 39 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 41 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 3 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/types.py | 3 | CODE | |
| 53 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/e2e-tests/2026-05-19-oom-reproduction-report.md | 209 | ### 为什么 128K context window 更容易触发 | COMMENT |
| MEDIUM | docs/users/configuration/settings.md | 171 | | `model.chatCompression.contextPercentageThreshold` | number | **REMOVED.** Replaced by `context.autoCompactThreshold` | CODE |
| MEDIUM | docs/users/features/arena.md | 201 | ## Comparison with other multi-agent modes | COMMENT |
| MEDIUM | docs/users/features/dual-output.md | 63 | ### Multi-agent orchestration | COMMENT |
| MEDIUM | docs/users/features/approval-mode.md | 260 | ### Safety guardrails | COMMENT |
| MEDIUM | docs/developers/daemon/09-event-schema.md | 63 | ### MCP guardrails (PR 14b + F2) | COMMENT |
| MEDIUM | scripts/copy_bundle_assets.js | 106 | // Copy extension templates so bundled dist/cli.js can scaffold | COMMENT |
| MEDIUM | …river/rust/crates/cua-driver-core/src/text_sanitize.rs | 19 | //! closing tags before the text leaves the tool layer. Three guardrails | COMMENT |
| MEDIUM | …river/rust/crates/cua-driver-core/src/text_sanitize.rs | 59 | /// See module docs for the false-positive guardrails. The function is | COMMENT |
| MEDIUM | packages/core/src/index.ts | 319 | // Foundational utilities (paths, storage scaffold, type definitions, constants) | COMMENT |
| MEDIUM | packages/core/src/tools/priorReadEnforcement.ts | 132 | * fires identically for both tools. Issue #2499 (model hallucinates | COMMENT |
| MEDIUM | packages/core/src/tools/mcp-client-manager.test.ts | 2162 | // Issue #4175 PR 14: MCP client guardrails (counter + slot reservation + | COMMENT |
| MEDIUM | packages/core/src/tools/mcp-client-manager.test.ts | 2162 | // Issue #4175 PR 14: MCP client guardrails (counter + slot reservation + | COMMENT |
| MEDIUM | packages/core/src/core/turn.ts | 434 | // A turn manages the agentic loop turn within the server context. | COMMENT |
| MEDIUM | …s/core/src/core/anthropicContentGenerator/converter.ts | 833 | // `messages.content`. In agentic loops the last user message after | COMMENT |
| MEDIUM | …e/src/core/anthropicContentGenerator/converter.test.ts | 2069 | // Regression: in agentic loops the last user message is typically a | COMMENT |
| MEDIUM | packages/core/src/memory/extract.ts | 110 | // Per-project scaffold is required (extraction cursor + metadata live | COMMENT |
| MEDIUM | packages/core/src/memory/extract.ts | 111 | // there). User-level scaffold is optional — a brand-new user without | COMMENT |
| MEDIUM | packages/core/src/memory/extract.ts | 182 | // cursor. Catch + warn, same shape as the user-level scaffold above. | COMMENT |
| MEDIUM | packages/core/src/memory/manager.test.ts | 1146 | // still be the scaffold's initial value, not the cancelled-run's | COMMENT |
| MEDIUM | packages/core/src/memory/extract.test.ts | 546 | it('BUG #6311: should NOT advance cursor when agent makes zero tool calls (hallucination)', async () => { | CODE |
| MEDIUM | packages/core/src/memory/userMemory.test.ts | 137 | // Unlike per-project scaffold, no meta.json / extract-cursor.json | COMMENT |
| MEDIUM | packages/desktop/CONTRIBUTING.md | 75 | │ ├── server-core/ # Server/session orchestration | CODE |
| MEDIUM | packages/desktop/packages/shared/src/config/storage.ts | 361 | // the place where the app should scaffold config/status/label files. | COMMENT |
| MEDIUM | …desktop/packages/messaging-gateway/src/pairing.test.ts | 70 | // Internal access is ugly but cheaper than a fake-clock scaffold. | COMMENT |
| MEDIUM | …ron/src/transport/__tests__/channel-map-parity.test.ts | 39 | // Compile-time guardrails: if these fail, CHANNEL_MAP and ElectronAPI drifted. | COMMENT |
| MEDIUM | …kages/desktop/apps/electron/src/shared/route-parser.ts | 197 | // Automations navigator - supports type filters (scheduled, event, agentic) | COMMENT |
| MEDIUM | …kages/desktop/apps/electron/src/shared/route-parser.ts | 203 | // Check for type filter: automations/scheduled, automations/event, automations/agentic | COMMENT |
| MEDIUM | …kages/desktop/apps/electron/src/shared/route-parser.ts | 334 | // Build base from filter (automations, automations/scheduled, automations/event, automations/agentic) | COMMENT |
| MEDIUM | packages/cli/src/ui/voice/voice-keyterms.test.ts | 93 | '# project terms\n\n Kubernetes # container orchestration \nIssue #42\nPR #5817\nC#\nF#\n # indented comment | CODE |
| MEDIUM | packages/cli/src/ui/voice/voice-keyterms.test.ts | 96 | expect(terms).toContain('Kubernetes # container orchestration'); | CODE |
| MEDIUM | packages/cli/src/serve/run-qwen-serve.ts | 2174 | // The MCP client guardrails enforce in the ACP child process (where | COMMENT |
| MEDIUM | packages/cli/src/serve/server.test.ts | 292 | // init scaffold, and MCP server restart). | COMMENT |
| MEDIUM | packages/sdk-typescript/src/daemon/events.ts | 2068 | // QWEN.md scaffold was performed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | packages/sdk-python/tests/unit/test_query_core.py | 481 | transport.push( | CODE |
| HIGH⚡ | packages/sdk-python/tests/unit/test_query_core.py | 491 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 125 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 146 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 181 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 236 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 250 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 271 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 279 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 333 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 347 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 406 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 420 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 569 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 600 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 627 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 654 | transport.push( | CODE |
| HIGH | packages/sdk-python/tests/unit/test_query_core.py | 691 | transport.push( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .qwen/skills/desktop-pet/scripts/gen_spritesheet.py | 72 | CODE | |
| LOW | .qwen/skills/desktop-pet/scripts/gen_spritesheet.py | 194 | CODE | |
| LOW | …kills/agent-reproduce-feature/scripts/capture_state.py | 255 | CODE | |
| LOW | …kills/agent-reproduce-feature/scripts/capture_state.py | 480 | CODE | |
| LOW | …kills/agent-reproduce-align/scripts/normalize_trace.py | 77 | CODE | |
| LOW | integration-tests/concurrent-runner/runner.py | 892 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/transport.py | 91 | CODE | |
| LOW | packages/sdk-python/src/qwen_code_sdk/validation.py | 83 | CODE | |
| LOW | packages/cua-driver/python/build_wheel.py | 27 | CODE | |
| LOW | packages/cua-driver/python/build_wheel.py | 106 | CODE | |
| LOW | packages/cua-driver/python/build_wheel.py | 132 | CODE | |
| LOW | packages/cua-driver/python/build_wheel.py | 166 | CODE | |
| LOW | packages/cua-driver/python/build_wheel.py | 213 | CODE | |
| LOW | …river/rust/tests/integration/test_cursor_visibility.py | 48 | CODE | |
| LOW | …driver/rust/tests/integration/test_background_focus.py | 286 | CODE | |
| LOW | …ges/cua-driver/rust/tests/integration/driver_client.py | 97 | CODE | |
| LOW | …s/cua-driver/rust/tests/integration/v2/test_blender.py | 57 | CODE | |
| LOW | …iver/test-harness/modality-recordings/macos/mac-rec.py | 380 | CODE | |
| LOW | …iver/test-harness/modality-recordings/macos/mac-rec.py | 409 | CODE | |
| LOW | …iver/test-harness/modality-recordings/macos/mac-rec.py | 454 | CODE | |
| LOW | …-harness/modality-recordings/linux/lin-rec-electron.py | 268 | CODE | |
| LOW | …iver/test-harness/modality-recordings/linux/lin-rec.py | 232 | CODE | |
| LOW | …/.agents/skills/desktop-pet/scripts/gen_spritesheet.py | 72 | CODE | |
| LOW | …/.agents/skills/desktop-pet/scripts/gen_spritesheet.py | 194 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/xlsx_tool.py | 69 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/xlsx_tool.py | 124 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/xlsx_tool.py | 188 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/xlsx_tool.py | 320 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/docx_tool.py | 88 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/docx_tool.py | 161 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/docx_tool.py | 295 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/docx_tool.py | 358 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/pdf_tool.py | 71 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/pdf_tool.py | 465 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/pdf_tool.py | 647 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/pdf_tool.py | 684 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/pdf_tool.py | 1022 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/pdf_tool.py | 1244 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/doc_diff.py | 86 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/doc_diff.py | 125 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/ical_tool.py | 123 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/ical_tool.py | 176 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/ical_tool.py | 286 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/img_tool.py | 76 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/img_tool.py | 208 | CODE | |
| LOW | …es/desktop/apps/electron/resources/scripts/img_tool.py | 264 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/pptx_tool.py | 44 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/pptx_tool.py | 165 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/pptx_tool.py | 251 | CODE | |
| LOW | …s/desktop/apps/electron/resources/scripts/pptx_tool.py | 305 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …capture/table-pending-height-scroll-lock-regression.ts | 65 | 'lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna ali | CODE |
| LOW | …capture/table-pending-height-scroll-lock-regression.ts | 65 | 'lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna ali | CODE |
| LOW | integration-tests/cli/qwen-serve-routes.test.ts | 158 | OPENAI_API_KEY: 'fake-key', | CODE |
| LOW | …tegration-tests/cli/qwen-serve-channel-workers.test.ts | 239 | OPENAI_API_KEY: 'fake-key', | CODE |
| LOW | …tegration-tests/cli/qwen-serve-channel-workers.test.ts | 419 | OPENAI_API_KEY: 'fake-key', | CODE |
| LOW | integration-tests/cli/qwen-serve-client-mcp.test.ts | 133 | OPENAI_API_KEY: 'fake-key', | CODE |
| LOW | integration-tests/cli/qwen-serve-streaming.test.ts | 136 | OPENAI_API_KEY: 'fake-key', | CODE |
| LOW | integration-tests/sdk-typescript/tool-control.test.ts | 381 | OPENAI_API_KEY: 'fake-key', | CODE |
| LOW | integration-tests/sdk-typescript/tool-control.test.ts | 1105 | OPENAI_API_KEY: 'fake-key', | CODE |
| LOW | …on-tests/interactive/protocol-tags-interactive.test.ts | 115 | 'fake-key', | CODE |
| LOW | …river/rust/crates/cua-driver-core/src/text_sanitize.rs | 229 | let ok = "Lorem ipsum dolor sit amet."; | CODE |
| LOW | …river/rust/crates/cua-driver-core/src/text_sanitize.rs | 229 | let ok = "Lorem ipsum dolor sit amet."; | CODE |
| LOW | …ua-driver/rust/crates/platform-macos/src/tools/page.rs | 242 | "['tagName','textContent','href','id','class','type','value','placeholder','name']" | CODE |
| LOW | packages/core/src/core/geminiChat.test.ts | 9222 | const filler = 'lorem ipsum dolor sit amet '.repeat(20); | CODE |
| LOW | packages/core/src/core/geminiChat.test.ts | 9222 | const filler = 'lorem ipsum dolor sit amet '.repeat(20); | CODE |
| LOW | packages/core/src/utils/fileUtils.test.ts | 2743 | actualNodeFs.writeFileSync(testTextFilePath, 'placeholder'); | CODE |
| LOW | packages/mobile-mcp/CHANGELOG.md | 32 | * iOS: Added 'placeholder' to view tree response | COMMENT |
| LOW | …/shared/src/sources/__tests__/multi-header-e2e.test.ts | 235 | 'X-Auth-Email': 'user@example.com', | CODE |
| LOW | …/shared/src/sources/__tests__/multi-header-e2e.test.ts | 242 | expect(headers['X-Auth-Email']).toBe('user@example.com'); | CODE |
| LOW | …shared/src/sources/__tests__/multi-header-auth.test.ts | 192 | 'X-Auth-Email': 'user@example.com', | CODE |
| LOW | …shared/src/sources/__tests__/multi-header-auth.test.ts | 203 | expect(headers['X-Auth-Email']).toBe('user@example.com'); | CODE |
| LOW | …es/desktop/apps/electron/resources/docs/data-tables.md | 35 | { "name": "Acme Corp", "revenue": 4200000, "growth": 0.152, "active": true, "tier": "Enterprise" }, | CODE |
| LOW | …es/desktop/apps/electron/resources/docs/data-tables.md | 65 | | `text` | Any string | Plain text | `"John Doe"` | John Doe | | CODE |
| LOW | …tron/src/renderer/playground/registry/edit-popover.tsx | 427 | name: 'placeholder', | CODE |
| LOW | …lectron/src/renderer/playground/registry/turn-card.tsx | 1678 | name: 'Acme Corp', | CODE |
| LOW | …electron/src/renderer/playground/registry/messages.tsx | 473 | email: 'user@example.com', | CODE |
| LOW | …electron/src/renderer/playground/registry/messages.tsx | 860 | email: 'user@example.com', | CODE |
| LOW | …pps/electron/src/renderer/playground/registry/chat.tsx | 1393 | name: 'placeholder', | CODE |
| LOW | …n/src/renderer/utils/__tests__/auth-validation.test.ts | 229 | expect(validateBasicAuthCredentials('user@example.com', 'pass', true)).toBe(true) | CODE |
| LOW | packages/cli/src/validateNonInterActiveAuth.test.ts | 249 | process.env['OPENAI_API_KEY'] = 'fake-key'; | CODE |
| LOW | packages/cli/src/validateNonInterActiveAuth.test.ts | 268 | process.env['OPENAI_API_KEY'] = 'fake-key'; | CODE |
| LOW | packages/cli/src/validateNonInterActiveAuth.test.ts | 350 | process.env['OPENAI_API_KEY'] = 'fake-key'; | CODE |
| LOW | packages/cli/src/validateNonInterActiveAuth.test.ts | 389 | process.env['OPENAI_API_KEY'] = 'fake-key'; | CODE |
| LOW | packages/cli/src/validateNonInterActiveAuth.test.ts | 486 | process.env['OPENAI_API_KEY'] = 'fake-key'; | CODE |
| LOW | packages/cli/src/validateNonInterActiveAuth.test.ts | 526 | process.env['OPENAI_API_KEY'] = 'fake-key'; | CODE |
| LOW | packages/cli/src/ui/utils/MermaidDiagram.test.tsx | 41 | lines: ['placeholder'], | CODE |
| LOW⚡ | …kages/cli/src/ui/components/shared/text-buffer.test.ts | 1547 | const longText = `not only five centuries, but also the leap into electronic typesetting, remaining essentially un | CODE |
| LOW⚡ | …kages/cli/src/ui/components/shared/text-buffer.test.ts | 1550 | It is a long established fact that a reader will be distracted by the readable content of a page when looking at its lay | CODE |
| LOW⚡ | …kages/cli/src/ui/components/shared/text-buffer.test.ts | 1553 | Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece of classical Latin literature | CODE |
| LOW | packages/cli/src/ui/hooks/useCommandCompletion.test.ts | 241 | const text = 'user@example.com'; | CODE |
| LOW | packages/cli/src/config/auth.test.ts | 42 | process.env['OPENAI_API_KEY'] = 'fake-key'; | CODE |
| LOW | …webui/src/components/ChatViewer/ChatViewer.stories.tsx | 145 | 'You can define an interface in TypeScript like this:\n\n```typescript\ninterface User {\n id: number;\n name: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …desktop/packages/ui/src/components/markdown/linkify.ts | 249 | // (e.g., AI-generated `[commit](https://github.com/...)` → `\`commit\``) | COMMENT |
| HIGH | …op/packages/server-core/src/sessions/SessionManager.ts | 1070 | // Session name (user-defined or AI-generated) | COMMENT |
| HIGH | …s/desktop/apps/electron/src/renderer/atoms/sessions.ts | 184 | // Include plan messages as final responses (they're AI-generated content) | COMMENT |
| HIGH | …es/desktop/apps/electron/src/renderer/utils/session.ts | 89 | // Include plan messages as final responses (they're AI-generated content) | COMMENT |
| HIGH | packages/cli/src/serve/web-shell-static.ts | 35 | // (the SPA renders AI-generated markdown) cannot repoint relative URLs to an | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/users/qwen-serve-deploy-local.md | 107 | <string>PASTE-YOUR-TOKEN-HERE</string> | CODE |
| HIGH | docs/users/configuration/model-providers.md | 390 | > BAILIAN_CODING_PLAN_API_KEY=your-api-key-here | CODE |
| HIGH | docs/developers/tools/web-search.md | 165 | "TAVILY_API_KEY": "your-api-key-here" | CODE |
| HIGH | …ckages/desktop/apps/electron/resources/docs/sources.md | 393 | "BRAVE_API_KEY": "your-api-key" | CODE |
| HIGH | …lectron/src/renderer/playground/registry/turn-card.tsx | 1747 | Authorization: Bearer YOUR_API_KEY | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/test-rewind-e2e.sh | 18 | # Usage: | COMMENT |
| LOW | scripts/sign-release.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/installation/install-qwen-with-source.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/installation/install-qwen-standalone.sh | 7 | # Usage: | COMMENT |
| LOW | packages/cua-driver/rust/tests/integration/run_tests.sh | 4 | # Usage: | COMMENT |
| LOW⚡ | packages/cua-driver/scripts/uninstall.sh | 54 | # Usage: | COMMENT |
| LOW | packages/cua-driver/scripts/sync-from-upstream.sh | 13 | # Usage: | COMMENT |
| LOW | packages/mobile-mcp/scripts/sync-from-upstream.sh | 4 | # Usage: | COMMENT |
| LOW | packages/desktop/scripts/install-server.sh | 4 | # Usage: | COMMENT |
| LOW⚡ | packages/desktop/scripts/docker-smoke-test.sh | 8 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | integration-tests/cli/notebook-edit.test.ts | 141 | print(result) | CODE |
| HIGH | packages/core/src/tools/todoWrite.ts | 167 | print("Hello World") | CODE |
| HIGH | …lectron/src/renderer/playground/registry/turn-card.tsx | 1340 | elif model_type == "gradient_boosting": | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | integration-tests/concurrent-runner/runner.py | 214 | # Create a unique branch for this worktree based on the specified branch | COMMENT |
| MEDIUM | …es/desktop/apps/electron/resources/scripts/pdf_tool.py | 897 | # Create a single-page image PDF and merge into output | COMMENT |
| MEDIUM | packages/webui/scripts/add-license-header.sh | 34 | # Create a temporary file with the license header followed by the original content | COMMENT |
| MEDIUM | .github/workflows/release-sdk.yml | 290 | # Create a metadata file to record which CLI version was bundled | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …al-bench/ci-tasks/hello-world/tests/setup-uv-pytest.sh | 12 | # Check if we're in a valid working directory | COMMENT |
| LOW | scripts/create_alias.sh | 24 | # Check if the alias already exists | COMMENT |
| LOW | packages/desktop/scripts/docker-smoke-test.sh | 52 | # Check if container is still running | COMMENT |
| LOW | packages/desktop/scripts/install-app.sh | 41 | # Check if yq is available (optional, for YAML parsing) | COMMENT |
| LOW | packages/desktop/scripts/install-app.sh | 90 | # Check if we're entering a new file entry | COMMENT |
| LOW | packages/desktop/scripts/install-app.sh | 120 | # Check if we're entering a new file entry | COMMENT |
| LOW | packages/webui/scripts/add-license-header.sh | 30 | # Check if the file starts with the license header | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/sdk-python/src/qwen_code_sdk/query.py | 478 | async def set_permission_mode(self, mode: str) -> None: | CODE |
| LOW⚡ | packages/sdk-python/src/qwen_code_sdk/query.py | 482 | async def set_model(self, model: str) -> None: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/__init__.py | 65 | __all__ = [ | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 117 | def set_model(self, model: str) -> None: | CODE |
| LOW | packages/sdk-python/src/qwen_code_sdk/sync_query.py | 123 | def set_permission_mode(self, mode: str) -> None: | CODE |
| LOW | packages/cua-driver/python/src/cua_driver/__init__.py | 11 | __all__ = ["run_cua_driver", "get_binary_path", "__version__"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .qwen/skills/e2e-testing/scripts/mock-openai-server.js | 54 | function handleRequest({ body, inputTokens, requestIndex }) { | CODE |
| LOW | packages/core/src/utils/fileUtils.test.ts | 930 | '<?php\nfunction handleRequest() {\n return true;\n}\n', | CODE |
| LOW | …ed/src/utils/__tests__/binary-detection-base64.test.ts | 26 | function processData(items: string[]): Map<string, number> { | CODE |
| LOW | …desktop/packages/server-core/src/webui/node-adapter.ts | 33 | async function handleRequest( | CODE |
| LOW | …top/apps/electron/resources/bridge-mcp-server/index.js | 2721 | function getData($data, { dataLevel, dataNames, dataPathArr }) { | CODE |
| LOW | …top/apps/electron/resources/bridge-mcp-server/index.js | 9034 | function getData($data, { dataLevel, dataNames, dataPathArr }) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .qwen/skills/desktop-pet/scripts/gen_spritesheet.py | 194 | CODE | |
| LOW | …/.agents/skills/desktop-pet/scripts/gen_spritesheet.py | 194 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …webui/src/components/ChatViewer/ChatViewer.stories.tsx | 112 | "To create a React component, you can use either a function or a class. Here's a simple example of a functional | CODE |